throw it in the river: towards real live actual smartphone security
DESCRIPTION
TRANSCRIPT
Throw It in the River? Towards Real Live Actual
Smartphone Security
© Georgia Weidman 2011
Georgia Weidman
1
Agenda
• Problems and Potential Solutions –Encryption
–Applications
–Updates
–User Awareness
© Georgia Weidman 2011 2
Notes
• This talk focuses on Android and iPhone
• Briefly touches on Windows Mobile and Blackberry
• Radio based topics cover only GSM
© Georgia Weidman 2011 3
Encryption
© Georgia Weidman 2011 4
Encryption Problems
• Encryption between phone and base station:
– 2G:
• Up to the base station to encrypt or not encrypt
• Stream cipher A5/1
• Broken (Karsten Nohl Blackhat USA 2010)
– 3G:
• Encrypted
• Stream cipher KASUMI(A5/3)
• Conceptually broken
© Georgia Weidman 2011 5
Interception
• Possible to get phones to attach to a rogue base station
• 2G rogue base station (Chris Pagent Defcon 2010)
• Intercept all traffic while phone still works normally
© Georgia Weidman 2011 6
The Path of Least Resistance
• 4G/3G/2G are not backward compatible
• Current phones still have 2G radio
• Default is to use both 2G and 3G
• When 3G not available phones will use 2G
• 3G can be jammed to force phones to fall back
© Georgia Weidman 2011 7
Mitigation 1: Turn off 2G
• Forcing 2G use only is an available setting on modern smartphones
• Forcing 3G+ only is not on iPhone or Android (seems to be on Blackberry)
• We need to see this setting made available and default
© Georgia Weidman 2011 8
Mitigation #2: Encrypt before Using
• Telephony data sent over GSM is encoded not encrypted
• Only encryption is the stream encryption
• Smartphones have the resources and tools to add encryption (openssl etc.)
© Georgia Weidman 2011 9
Case Study: SMS SMS-Deliver PDU
Field Value
Length of SMSC 07
Type of Address (SMSC) 91
Service Center Address (SMSC) 41 40 54 05 10 F1
SMS Deliver Info 04
Length of Sender Number 0B
Type of Sender Number 91
Sender Number 51 17 34 45 88 F1
Protocol Identifier 00
Data Coding Scheme 00
Time Stamp 01 21 03 71 40 04 4A
User Data Length 0A
User Data E8 32 9B FD 46 97 D9 EC 37
© Georgia Weidman 2011 10
Case Study: SMS SMS-Deliver PDU
Field Value
Length of SMSC 07
Type of Address (SMSC) 91
Service Center Address (SMSC) 41 40 54 05 10 F1
SMS Deliver Info 04
Length of Sender Number 0B
Type of Sender Number 91
Sender Number 51 17 34 45 88 F1
Protocol Identifier 00
Data Coding Scheme 00
Time Stamp 01 21 03 71 40 04 4A
User Data Length 0A
User Data E8 32 9B FD 46 97 D9 EC 37 © Georgia Weidman 2011 11
Case Study: SMS
• Given an intercepted PDU 7bit GSM encoding is reversible
• All data is recoverable
• Ex: From: <redacted> Message: hellohello
• Crafting a spoofed SMS-Send PDU is also possible
© Georgia Weidman 2011 12
Why We Care about SMS?
• Two Factor Authentication/ Account verification – Sends SMS with OTP
– Verify with SMS on account setup
• Mobile Banking – One time passwords for banking sent to
customer’s over SMS
– Balance reporting
– Electronic bill paying
© Georgia Weidman 2011 13
Why We Care about SMS
• Vendor text messages Congrats <vendor> has this awesome product to protect your phone Go <here> to download it.
– Links to a 3rd party app store
– How do I know this came from <vendor>?
Example: T-mobile Mobile Security
© Georgia Weidman 2011 14
Encrypting SMS
• Intercept SMS after the application send the message/before it goes to modem
• Encrypt it and adjust SMS-Send PDU
• Upon arrival decrypt with the key for the sender number
• Then send to user application
© Georgia Weidman 2011 15
Demo
Encrypted SMS on Android
© Georgia Weidman 2011 16
Applications
Software that runs on the smartphones
© Georgia Weidman 2011 17
Android Apps Store
• Anyone can write an app and upload to the Android market
• $25 signup fee
• Anonymous signup possible
• No certificate authority/self signed apps
© Georgia Weidman 2011 18
iPhone App Store
• Must have a developer certificate to even run code on your own device
• $99/year
• Identity is verified
• All code is reviewed and signed before upload to the store
© Georgia Weidman 2011 19
iPhone Security Protections
• Mandatory code signing/ apps cannot load new code at runtime
• ASLR on system binaries and some apps in 4.3 and later
• Individual apps sandboxed with MAC for system permissions etc.
© Georgia Weidman 2011 20
Android Security Protections
• User must accept application permissions upon install
© Georgia Weidman 2011 21
Android Insecurity
• Can load new code at runtime (Twilight Botnet, Rootstrap app)
• Sandbox is flawed, any app can exploit a kernel vulnerability
• Apps can have any permissions they want if user will approve them (DroidDream)
© Georgia Weidman 2011 22
iPhone Insecurity
• Not all apps are compiled with full ASLR
• Patches for apps go through slow review process
© Georgia Weidman 2011 23
Software Updates
• Smartphones are subject to security flaws
• Ex: Sendpage Linux Kernel exploit
• Software updates address security issues
© Georgia Weidman 2011 24
How Smartphones Update
• Android – Pushes updates out over the air
• iPhone – Updates through iTunes – Can update when attached to a computer with iTunes
• Windows Mobile – Updates through Windows Mobile Activesync – Can update when attached to a computer with Activesync
• Blackberry – Check for updates at Blackberry website – Download updates to computer – Connect phone to computer and run updates
© Georgia Weidman 2011 25
Why are Android Updates Slow?
• Google puts out the new version
• Google releases source to other platform makers
• Platform makers port new version with custom UI, apps, etc.
• Previous updates have taken over 6 months
© Georgia Weidman 2011 26
Android’s Way on Other Platforms
• A simple solution for alerting user’s to updates over the air
• System application checks currently installed firmware version
• Periodically calls out to update server for current updated version
• If update is available instructs the user to plug in and update
© Georgia Weidman 2011 27
Demo
Update Application on iPhone
© Georgia Weidman 2011 28
User Awareness Fails
• Great strides in computer user awareness
• Not seeing the same with smartphones
• With smartphones users have even more to lose
© Georgia Weidman 2011 29
Too Many App Permissions
• Android apps can request any permissions they want.
• Up to the user to decide to decide if app is safe
• Foursquare would need GPS but not SMS
• Is this system working?
© Georgia Weidman 2011 30
Top Downloaded Android App of all time
© Georgia Weidman 2011 31
Facebook App
• Edit and Read SMS, send SMS, receive SMS • Modify/delete USB storage contents • Prevent phone from sleeping, write sync settings • GPS data • Services that cost you money • Act as account authenticator, manage accounts • Read and write to your personal information
including contact data • Phone calls, read phone state and identity • Full network access
© Georgia Weidman 2011 32
Jailbreaking Gone Wild
• Original Android G1 jailbreak: go to home screen, hit enter twice, type telnetd …
• Current iPhone and Android Jailbreaks: Go to this website and say yes to running this unknown binary by an unknown person
• It roots the phone, what else does it do?
© Georgia Weidman 2011 33
Raising User Awareness
• Stop with those “our apps are better/download all our apps” commercials
• Ethical root/jailbreak programs should inform users of the risks
• Smartphone security training in organizations
© Georgia Weidman 2011 34
Contact
Georgia Weidman
Neohapsis Inc. Email: [email protected]
[email protected] Website: http://www.grmn00bs.com
Twitter: @vincentkadmon
Code and Slides on website
© Georgia Weidman 2011 35
Selected Bibliography
• Chris Pagent “Practical Cellphone Spying” Defcon 2010: http://www.tombom.co.uk/cellphonespying.od
• Karsten Nohl “Attacking Phone Privacy” Blackhat USA 2010: https://media.blackhat.com/bh-us-10/whitepapers/Nohl/BlackHat-USA-2010-Nohl-Attacking.Phone.Privacy-wp.pdf
• John Oberheide and Jach Lanier “Team JOCH vs. Android” Shmoocon 2011: http://jon.oberheide.org/files/shmoo11-teamjoch.pdf
• Dino Dai Zovi “Apple iOS Security Evalution” Blackhat USA 2011: https://media.blackhat.com/bh-us-11/DaiZovi/BH_US_11_DaiZovi_iOS_Security_WP.pdf
© Georgia Weidman 2011 36